CVE-2026-42280

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-42280", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-04-26T11:53:27.717Z", "datePublished": "2026-05-27T14:39:15.789Z", "dateUpdated": "2026-05-28T15:36:56.102Z"}, "containers": {"cna": {"title": "Improper Permission Checking in Auth.js SDK", "problemTypes": [{"descriptions": [{"cweId": "CWE-863", "lang": "en", "description": "CWE-863: Incorrect Authorization", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.1, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/auth0/auth0.js/security/advisories/GHSA-8qjv-jj2q-x832", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/auth0/auth0.js/security/advisories/GHSA-8qjv-jj2q-x832"}], "affected": [{"vendor": "auth0", "product": "auth0.js", "versions": [{"version": ">= 8.11.0 , <= 9.32.0", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-05-27T14:39:15.789Z"}, "descriptions": [{"lang": "en", "value": "Auth0.js is a client-side JavaScript library for Auth0. From 8.11.0 to 9.32.0, under specific preconditions, the Auth0.js SDK may improperly return user profile information using a valid access token when a specifically crafted invalid ID token is provided. This vulnerability is fixed in 10.0.0."}], "source": {"advisory": "GHSA-8qjv-jj2q-x832", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-05-28T15:36:47.306227Z", "id": "CVE-2026-42280", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-05-28T15:36:56.102Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-42280", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-05-28T15:36:47.306227Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-05-28T15:36:51.445Z"}}], "cna": {"title": "Improper Permission Checking in Auth.js SDK", "source": {"advisory": "GHSA-8qjv-jj2q-x832", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.1, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "auth0", "product": "auth0.js", "versions": [{"status": "affected", "version": ">= 8.11.0 , <= 9.32.0"}]}], "references": [{"url": "https://github.com/auth0/auth0.js/security/advisories/GHSA-8qjv-jj2q-x832", "name": "https://github.com/auth0/auth0.js/security/advisories/GHSA-8qjv-jj2q-x832", "tags": ["x_refsource_CONFIRM"]}], "descriptions": [{"lang": "en", "value": "Auth0.js is a client-side JavaScript library for Auth0. From 8.11.0 to 9.32.0, under specific preconditions, the Auth0.js SDK may improperly return user profile information using a valid access token when a specifically crafted invalid ID token is provided. This vulnerability is fixed in 10.0.0."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-863", "description": "CWE-863: Incorrect Authorization"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-05-27T14:39:15.789Z"}}}, "cveMetadata": {"cveId": "CVE-2026-42280", "state": "PUBLISHED", "dateUpdated": "2026-05-28T15:36:56.102Z", "dateReserved": "2026-04-26T11:53:27.717Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-05-27T14:39:15.789Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "auth0.js", "vendor": "auth0", "versions": [{"status": "affected", "version": ">= 8.11.0 , <= 9.32.0"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:auth0:auth0.js:*:*:*:*:*:node.js:*:*", "matchCriteriaId": "F16E19EA-BB12-42DA-96ED-602A8FC930C0", "versionEndExcluding": "10.0.0", "versionStartIncluding": "8.11.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Auth0.js is a client-side JavaScript library for Auth0. From 8.11.0 to 9.32.0, under specific preconditions, the Auth0.js SDK may improperly return user profile information using a valid access token when a specifically crafted invalid ID token is provided. This vulnerability is fixed in 10.0.0."}, {"lang": "es", "value": "Auth0.js es una biblioteca JavaScript del lado del cliente para Auth0. Desde la versi\u00f3n 8.11.0 hasta la 9.32.0, bajo precondiciones espec\u00edficas, el SDK de Auth0.js puede devolver incorrectamente informaci\u00f3n de perfil de usuario utilizando un token de acceso v\u00e1lido cuando se proporciona un token de ID no v\u00e1lido espec\u00edficamente dise\u00f1ado. Esta vulnerabilidad se corrige en la versi\u00f3n 10.0.0."}], "id": "CVE-2026-42280", "lastModified": "2026-10-26T11:10:00.157", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.1, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 4.2, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-42280", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-05-28T15:36:47.306227Z", "version": "2.0.3"}}]}, "published": "2026-05-27T15:16:27.753", "references": [{"source": "security-advisories@github.com", "tags": ["Vendor Advisory"], "url": "https://github.com/auth0/auth0.js/security/advisories/GHSA-8qjv-jj2q-x832"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-863"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[8.11.0,9.32.0]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "auth0.js", "source": "cna", "vendor": "auth0"}, "product": "auth0.js", "vendor": "auth0"}], "created": "2026-05-27T19:45:40.918866+00:00", "updated": "2026-05-28T04:30:06.668001+00:00", "vendors": ["auth0", "auth0$PRODUCT$auth0.js"]}